Extracted

• • Target

    d496f178f6400d703c1bc434b7694369d94c68a5756f811bb5ded09ff78b1158.bin

  • Size

    120KB

  • MD5

    031d9264f4c5fb68ab00e9b820a5a869

  • SHA1

    268c830c713756bd60a33f765f49e6207ab3d2e5

  • SHA256

    d496f178f6400d703c1bc434b7694369d94c68a5756f811bb5ded09ff78b1158

  • SHA512

    0bce0870090603f68c7f5e5902accaaf1b79afc5d13d983ac28881a3f4ce268fb3ea50594609333de96801b0400f8bea4cae25d8c9b2f364b55d8b06d2bc4c72

  Score

  10^/10

  allcomestealersuricata

  • Allcome

    A clipbanker that supports stealing different cryptocurrency wallets and payment forms.

    stealerallcome

  • suricata: ET MALWARE Win32/ClipBanker.OC CnC Activity M1

    suricata: ET MALWARE Win32/ClipBanker.OC CnC Activity M1

    suricata

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2